1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
# Install kubectl (macOS)
brew install kubectl helm kustomize kubectx kubens stern k9s

# Linux
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
sudo install kubectl /usr/local/bin/

# Verify
kubectl version --client
kubectl cluster-info

# Local clusters
kind create cluster --name dev                 # Docker-in-Docker, fast
k3d cluster create dev                          # k3s in Docker
minikube start --driver=docker

# Cloud-managed (just snippets)
aws eks update-kubeconfig --name prod --region us-east-1
gcloud container clusters get-credentials prod --region us-central1
az aks get-credentials --resource-group rg --name prod

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
kubectl get <resource>                          # list
kubectl get pods -A                             # all namespaces
kubectl get pod,svc,deploy
kubectl get pods -o wide                        # node, IP
kubectl get pods -o yaml | less                 # full manifest
kubectl get pods -o jsonpath='{.items[*].metadata.name}'
kubectl get pods -l app=web,tier!=prod          # label selectors
kubectl get pods --field-selector status.phase=Running

kubectl describe pod <name>                     # human-readable inspection
kubectl explain pod.spec.containers             # field docs

kubectl apply -f manifest.yaml                  # declarative create/update
kubectl apply -k overlays/prod                  # kustomize
kubectl apply -R -f ./manifests/                # recursive

kubectl create deploy web --image=nginx         # imperative
kubectl run dbg --image=alpine -it --rm -- sh    # one-off pod

kubectl edit deploy web                         # edit live object in $EDITOR
kubectl patch deploy web --patch '{"spec":{"replicas":3}}'
kubectl scale deploy web --replicas=5
kubectl rollout restart deploy web

kubectl delete -f manifest.yaml
kubectl delete pod web-abc --force --grace-period=0
kubectl delete pods -l app=web

# Output formats
kubectl get pod web -o yaml | yq
kubectl get pod web -o json | jq
kubectl get pod web -o name                     # "pod/web"

1
2
3
4
5
6
alias k=kubectl
alias kgp='kubectl get pods'
alias kgs='kubectl get svc'
alias kgd='kubectl get deploy'
alias kdp='kubectl describe pod'

1
2
3
4
5
6
7
8
9
10
11
12
13
kubectl config get-contexts
kubectl config current-context
kubectl config use-context prod
kubectl config set-context --current --namespace=team-a    # set default ns

# kubectx / kubens (must-haves)
kubectx prod
kubens team-a

# Per-command override
kubectl get pods -n kube-system
kubectl get pods --context staging -n web

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
apiVersion: v1
kind: Pod
metadata:
  name: web
  labels: { app: web }
spec:
  serviceAccountName: web-sa
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 1000
    seccompProfile: { type: RuntimeDefault }
  containers:
  - name: app
    image: nginx:1.27
    ports: [{ containerPort: 80 }]
    env:
      - name: DATABASE_URL
        valueFrom: { secretKeyRef: { name: db, key: url } }
    resources:
      requests: { cpu: 100m, memory: 128Mi }
      limits:   { cpu: 500m, memory: 256Mi }
    readinessProbe: { httpGet: { path: /healthz, port: 80 } }
    livenessProbe:  { httpGet: { path: /healthz, port: 80 }, periodSeconds: 30 }
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities: { drop: [ALL] }
  volumes: []

1
2
3
4
5
6
7
8
kubectl get pods                              # see status: Running / Pending / CrashLoopBackOff
kubectl logs -f web                            # follow
kubectl logs --previous web                    # last crashed instance
kubectl logs web -c sidecar                    # specific container
kubectl exec -it web -- sh
kubectl cp web:/var/log/app.log ./app.log
kubectl port-forward pod/web 8080:80

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
apiVersion: apps/v1
kind: Deployment
metadata: { name: web }
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate: { maxSurge: 1, maxUnavailable: 0 }
  selector: { matchLabels: { app: web } }
  template:
    metadata: { labels: { app: web } }
    spec:
      containers:
      - name: app
        image: ghcr.io/me/app:1.2.3
        ports: [{ containerPort: 3000 }]

1
2
3
4
5
6
kubectl rollout status deploy/web
kubectl rollout history deploy/web
kubectl rollout undo deploy/web                # to previous
kubectl rollout undo deploy/web --to-revision=3
kubectl set image deploy/web app=ghcr.io/me/app:1.2.4

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
apiVersion: apps/v1
kind: StatefulSet
metadata: { name: pg }
spec:
  serviceName: pg-headless
  replicas: 3
  selector: { matchLabels: { app: pg } }
  template:
    metadata: { labels: { app: pg } }
    spec:
      containers:
      - name: pg
        image: postgres:16
        volumeMounts: [{ name: data, mountPath: /var/lib/postgresql/data }]
  volumeClaimTemplates:
    - metadata: { name: data }
      spec:
        accessModes: [ReadWriteOnce]
        resources: { requests: { storage: 20Gi } }
        storageClassName: standard

1
2
3
4
5
6
7
8
9
10
11
12
13
apiVersion: apps/v1
kind: DaemonSet
metadata: { name: log-agent }
spec:
  selector: { matchLabels: { app: log-agent } }
  template:
    metadata: { labels: { app: log-agent } }
    spec:
      tolerations: [{ operator: Exists }]
      containers:
      - name: agent
        image: fluentbit:3

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
apiVersion: batch/v1
kind: Job
metadata: { name: migrate }
spec:
  backoffLimit: 3
  template:
    spec:
      restartPolicy: OnFailure
      containers:
      - name: migrate
        image: ghcr.io/me/app:1.2.3
        command: ["./migrate"]
---

apiVersion: batch/v1
kind: CronJob
metadata: { name: cleanup }
spec:
  schedule: "0 3 * * *"                          # 03:00 daily
  successfulJobsHistoryLimit: 3
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: OnFailure
          containers:
          - { name: c, image: alpine, command: ["sh","-c","./cleanup.sh"] }

1
2
3
4
5
6
7
8
9
10
11
apiVersion: v1
kind: Service
metadata: { name: web }
spec:
  type: ClusterIP                                # ClusterIP | NodePort | LoadBalancer | ExternalName
  selector: { app: web }
  ports:
    - name: http
      port: 80
      targetPort: 3000

1
2
3
4
5
kubectl get svc                                  # CLUSTER-IP, EXTERNAL-IP, PORTS
kubectl port-forward svc/web 8080:80
kubectl run dbg --rm -it --image=alpine -- sh
  # in pod: nslookup web.default.svc.cluster.local

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: web-allow }
spec:
  podSelector: { matchLabels: { app: web } }
  policyTypes: [Ingress, Egress]
  ingress:
    - from: [{ podSelector: { matchLabels: { app: gateway } } }]
      ports: [{ port: 3000 }]
  egress:
    - to:
        - namespaceSelector: { matchLabels: { kubernetes.io/metadata.name: kube-system } }
          podSelector: { matchLabels: { k8s-app: kube-dns } }
      ports: [{ port: 53, protocol: UDP }]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  ingressClassName: nginx
  tls:
    - hosts: [app.example.com]
      secretName: web-tls
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend: { service: { name: web, port: { number: 80 } } }

1
2
3
4
5
6
7
8
9
10
11
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata: { name: web }
spec:
  parentRefs: [{ name: gateway }]
  hostnames: [app.example.com]
  rules:
    - matches: [{ path: { type: PathPrefix, value: / } }]
      backendRefs:
        - { name: web, port: 80 }

1
2
3
4
5
6
7
8
9
10
kubectl create configmap app-config \
  --from-literal=LOG_LEVEL=info \
  --from-file=config.yaml

kubectl create secret generic db \
  --from-literal=password='s3cr3t'
kubectl create secret tls web-tls --cert=tls.crt --key=tls.key
kubectl create secret docker-registry ghcr --docker-server=ghcr.io \
  --docker-username=USER --docker-password=$TOKEN

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
# Mount as env
env:
  - name: LOG_LEVEL
    valueFrom: { configMapKeyRef: { name: app-config, key: LOG_LEVEL } }
  - name: DB_PASS
    valueFrom: { secretKeyRef: { name: db, key: password } }

envFrom:
  - configMapRef: { name: app-config }
  - secretRef:    { name: db }

# Mount as file
volumes:
  - name: cfg
    configMap: { name: app-config }
volumeMounts:
  - { name: cfg, mountPath: /etc/app }

1
2
3
4
5
6
7
8
9
# Persistent volume claim
apiVersion: v1
kind: PersistentVolumeClaim
metadata: { name: data }
spec:
  accessModes: [ReadWriteOnce]                  # RWO | ROX | RWX | RWOP
  resources: { requests: { storage: 10Gi } }
  storageClassName: standard

1
2
3
4
5
6
7
8
9
10
11
12
13
14
volumes:
  - name: data
    persistentVolumeClaim: { claimName: data }
  - name: scratch
    emptyDir: {}                                  # ephemeral, per-pod
  - name: cfg
    configMap: { name: app-config }
  - name: secret
    secret:    { secretName: db }
  - name: host
    hostPath:  { path: /var/log }                # ⚠️ host filesystem
volumeMounts:
  - { name: data, mountPath: /data }

1
2
3
kubectl get pv,pvc,sc
kubectl get storageclass

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
apiVersion: v1
kind: ServiceAccount
metadata: { name: web-sa }
---

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: { name: pod-reader, namespace: default }
rules:
  - apiGroups: [""]
    resources: [pods, pods/log]
    verbs: [get, list, watch]
---

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata: { name: web-sa-read }
subjects: [{ kind: ServiceAccount, name: web-sa, namespace: default }]
roleRef: { kind: Role, name: pod-reader, apiGroup: rbac.authorization.k8s.io }

1
2
3
4
kubectl auth can-i create deploy
kubectl auth can-i list pods --as system:serviceaccount:default:web-sa
kubectl auth whoami

1
2
3
4
5
6
7
8
9
10
11
12
13
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata: { name: web }
spec:
  scaleTargetRef: { apiVersion: apps/v1, kind: Deployment, name: web }
  minReplicas: 2
  maxReplicas: 20
  metrics:
    - type: Resource
      resource:
        name: cpu
        target: { type: Utilization, averageUtilization: 70 }

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
containers:
- name: app
  resources:
    requests: { cpu: 100m, memory: 128Mi }       # scheduler uses these
    limits:   { cpu: 500m, memory: 512Mi }       # enforced; OOMKill if exceeded
  startupProbe:
    httpGet: { path: /healthz, port: 80 }
    failureThreshold: 30
    periodSeconds: 5
  readinessProbe:                                # remove from Service if failing
    httpGet: { path: /ready, port: 80 }
    periodSeconds: 10
  livenessProbe:                                 # restart container if failing
    httpGet: { path: /live, port: 80 }
    periodSeconds: 30
    initialDelaySeconds: 30

1
2
3
4
5
6
7
8
9
apiVersion: v1
kind: ResourceQuota
metadata: { name: team-a }
spec:
  hard:
    requests.cpu: "20"
    requests.memory: 40Gi
    pods: "100"

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
kubectl logs -f deploy/web                       # all pods of a deployment
kubectl logs -f web-abc -c sidecar
kubectl logs --since=10m web
kubectl logs --tail=100 web

stern web                                         # multi-pod tail (great tool)
stern -l app=web --since 5m

kubectl exec -it web -- sh
kubectl exec web -- curl localhost:8080/metrics

# Ephemeral debug container (k8s 1.25+)
kubectl debug -it web --image=nicolaka/netshoot --target=app

# Port forwarding
kubectl port-forward deploy/web 8080:80
kubectl port-forward svc/web 8080:80

# Top
kubectl top pod
kubectl top node

# Events (sorted by time)
kubectl get events --sort-by=.lastTimestamp
kubectl get events --watch

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo update
helm search repo postgres

helm install pg bitnami/postgresql \
  --version 15.0.0 \
  --namespace data --create-namespace \
  --set auth.postgresPassword=secret \
  -f values.yaml

helm upgrade --install pg bitnami/postgresql -f values.yaml
helm list -A
helm history pg
helm rollback pg 2
helm uninstall pg

# Render templates locally
helm template myrelease ./chart --values values.yaml | kubectl apply -f -

# Chart skeleton
helm create mychart
helm lint mychart
helm package mychart

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
# base/kustomization.yaml
resources:
  - deployment.yaml
  - service.yaml
commonLabels: { app: web }
images:
  - name: ghcr.io/me/app
    newTag: 1.2.3

# overlays/prod/kustomization.yaml
resources: [../../base]
namespace: prod
replicas:
  - { name: web, count: 5 }
patches:
  - path: hpa-patch.yaml
configMapGenerator:
  - name: app-config
    literals: [LOG_LEVEL=warn]

1
2
3
kubectl apply -k overlays/prod
kubectl kustomize overlays/prod | less          # render only

1
2
3
4
kubectl get crd
kubectl api-resources | grep cert-manager
kubectl explain certificate.spec

1
2
git repo → ArgoCD/Flux → kubectl apply -k overlays/prod → cluster

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
# Pod stuck Pending
kubectl describe pod <name>                      # Events: usually scheduling / image pull
kubectl get events -n <ns> --sort-by=.lastTimestamp

# CrashLoopBackOff
kubectl logs <pod> --previous
kubectl describe pod <pod>                       # exit code, reason

# ImagePullBackOff
# - wrong tag / private registry without imagePullSecret
kubectl get pod -o jsonpath='{.spec.imagePullSecrets[*].name}'

# Service has no endpoints
kubectl get endpoints <svc>                      # empty → selector mismatch
kubectl get pods -l <service-selector> -o wide

# DNS broken
kubectl run dbg --rm -it --image=alpine -- sh
  # inside: nslookup kubernetes.default

# OOMKilled
# - bump memory limits, check JVM heap / Node --max-old-space-size

# "Unable to connect to the server"
kubectl config current-context
kubectl config view --minify

# Node problems
kubectl get nodes -o wide
kubectl describe node <node>
kubectl cordon <node>                            # mark unschedulable
kubectl drain <node> --ignore-daemonsets --delete-emptydir-data

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
# Cluster
kubectl cluster-info
kubectl get nodes -o wide
kubectl version

# Resources
kubectl get pods,svc,deploy,ing,pvc -A
kubectl describe <resource> <name>
kubectl explain <resource>.spec
kubectl get pod -o yaml
kubectl get pod -o jsonpath='{.spec.containers[*].image}'

# Apply / delete
kubectl apply -f file.yaml
kubectl apply -k overlays/prod
kubectl delete -f file.yaml

# Edit / scale / rollout
kubectl edit deploy web
kubectl scale deploy web --replicas=5
kubectl rollout restart deploy web
kubectl rollout undo deploy web

# Debug
kubectl logs -f <pod> [-c <container>] [--previous]
kubectl exec -it <pod> -- sh
kubectl debug -it <pod> --image=nicolaka/netshoot --target=<container>
kubectl port-forward svc/web 8080:80
kubectl top pod / node
kubectl get events --sort-by=.lastTimestamp

# Context / namespace
kubectx prod        kubens team-a
kubectl config use-context prod
kubectl config set-context --current --namespace=team-a

# Helm
helm upgrade --install rel chart -f values.yaml
helm rollback rel <rev>

# Kustomize
kubectl apply -k overlays/prod